Developers of the Debian have recently announced the implementation of repeated assemblies for all official Live-images of Debian 12.10, as well as for assemblies of all significant desktop from the repositories of Debian 11, 12, and 13 (Testing). They have provided instructions to help users create their own LIVE-images that are 100% identical at a binary level to the designed design. Users can also access ready-made live images.
In the entire Debian 12 repository, which contains 33223 starting packages, the support of repeated assemblies has reached 96.9% for architecture x86_64 and 96.5% for architecture ARM64. In the Debian Testing repositories, the level of repeated assemblies is estimated at 96.5% for the ARM64 architecture and 96.3% for x86_64 when re-electing 37322 source packages. However, the test of repeated assemblies in the Debian Testing repository has failed for 819 packages (2.2%), and 428 packages (1.1%) had common problems when assembling from the source code. In comparison, Arch Linux has implemented the possibility of repeated assembly for 86.3% of Core and Extra repository packages, totaling 12,800 packages. The Opensuse Factory repository, with 15754 packages, has achieved a 98.24% level of repeated assemblies.
Repeated assemblies provide users with the ability to create their own assemblies that match the proposed loading assemblies to ensure that the binary files distributed in packages and loading images are collected from the initiated starting texts and do not contain hidden changes. This ability to verify the identity of binary assembly reduces the reliance on trust in the distribution’s assembly infrastructure, which could compromise a compiler or assembly tools and lead to hidden bookmarks substitution.
When forming repeated assemblies, various nuances are taken into account, such as an accurate correspondence of